fix: serverInfo map data race and XMSSMT nil-deref

[dobby-coder]

Two correctness bugs found during the scheduled code-quality audit (atumd has Issues disabled upstream; findings tracked in encryption4all/dobby#88).

1. Data race on serverInfo.RequiredProofOfWork

computePowNonces mutates the map in place under serverInfoLock, but getServerInfo hands callers a struct copy that shares the same map, and the handlers (serverInfoHandler, processAtumRequest) read that map without holding the lock. That is a concurrent map read/write: the race detector flags it, and in production it can crash the whole process with fatal error: concurrent map read and map write when the nonce revolver fires while a request is in flight.

Fix: build the map fresh in computePowNonces and publish it by replacing the reference under the lock. The map is never mutated in place after publication, so readers always observe an immutable snapshot.

2. Nil-pointer dereference on XMSSMT stamp failure

In processAtumRequest, an error from stamper.CreateXMSSMTTimestamp was logged but swallowed, leaving resp.Stamp nil — then the code fell through to resp.Stamp.ServerUrl = …, dereferencing nil and panicking the request. Now it returns an internal error response to the client instead.

Tests

• Added TestServerInfoConcurrentAccess, a -race regression test for the map access. Verified it reports DATA RACE against the old in-place mutation and passes with the fix.
• go build, go vet, and go test -race ./... all clean locally.

Note: this branch does not change CI. I'd recommend the test step run go test -race ./... so this regression is guarded in CI, but the bot lacks the workflows permission to edit .github/workflows/delivery.yml — a maintainer would need to make that one-line change.

---

Pipeline fix (2026-06-12)

The Delivery workflow was failing at the Scan Image step (Anchore/Grype, --fail-on critical): the scratch image's static Go binary carried 7 critical advisories from golang.org/x/crypto v0.51.0 (GO-2026-5005/5006/5017/5019/5020/5021/5023), all fixed in v0.52.0.

• Bumped golang.org/x/crypto v0.51.0 → v0.52.0 (direct import: ed25519, sha3; pulls golang.org/x/sys v0.44.0 → v0.45.0).
• Bumped toolchain go1.25.10 → go1.25.11 to also clear the remaining High stdlib advisories (below the critical gate, but makes the image vulnerability-clean).

Verified locally: go build, go vet, go test -race ./... pass, and grype --fail-on critical --only-fixed on the rebuilt static binary reports no vulnerabilities at any severity.

[rubenhensen]

/dobby the pipeline is failing, fix it

[dobby-coder]

Dobby is on it! 🧦

The pipeline is failing at the Grype image scan step — it found vulnerability matches at critical severity or above in the built Docker image. Dobby will investigate the CVEs and push a fix (base image bump or dependency update) to this branch.